The Flamix: Bitrix24 and Contact Form 7 integrations plugin for WordPress suffers from a Full Path Disclosure vulnerability (CWE-200) in all versions up to 3.1.0. This occurs because the plugin uses the mobiledetect library without restricting direct file access, enabling unauthenticated attackers to obtain the full filesystem path of the web application. The disclosed information alone is not sufficient to cause damage but can facilitate other attacks if combined with additional vulnerabilities. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity, no privileges required, no user interaction, and limited confidentiality impact.

The vulnerability exposes the full path of the web application to unauthenticated attackers. This information disclosure is limited in impact and does not directly affect integrity or availability. However, it may assist attackers in identifying the environment and planning further attacks if other vulnerabilities are present. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from the Flamix plugin vendor. Since the vulnerability requires no privileges or user interaction, restricting direct access to plugin files via web server configuration (e.g., using .htaccess rules) may reduce exposure. No vendor advisory or patch links are currently available.